Sun Fire X2100/X2200 M2 Servers Security Bypass and Remote Command Execution Vulnerability

Bugtraq ID:	33506
Class:	Unknown
CVE:	CVE-2009-0344 CVE-2009-0345
Remote:	Yes
Local:	No
Published:	Jan 28 2009 12:00AM
Updated:	Feb 11 2009 07:38PM
Credit:	Tomas Kopal
Vulnerable:	Sun Sun Fire X2200 M2 Server 0 Sun Sun Fire X2100 M2 Server 0
Not Vulnerable:

Sun Fire X2100/X2200 M2 Servers Security Bypass and Remote Command Execution Vulnerability

Sun Fire X2100 M2 and X2200 M2 Servers are prone to a security-bypass vulnerability and a remote command-execution vulnerability.

Successful exploits may allow attackers to gain unauthorized access or execute arbitrary commands on the Service Processor (SP). This may aid in further attacks.

Sun Fire X2100/X2200 M2 Servers with firmware prior to 3.20 are vulnerable.

Sun Fire X2100/X2200 M2 Servers Security Bypass and Remote Command Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sun Fire X2100/X2200 M2 Servers Security Bypass and Remote Command Execution Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

Sun Fire X2100/X2200 M2 Servers Security Bypass and Remote Command Execution Vulnerability

References:

• Sun Fire X2100 M2 Server (Sun)
  
• Sun Fire X2200 M2 Server (Sun)
  
• Security Vulnerabilities in the Embedded Lights Out Manager (ELOM) on Sun Fire X (Sun)